Setting up key based ssh

• NOTE: All SBGrid bound Servers and Workstations on the SBGrid network in the Longwood area require 'pub' key to be uploaded to our authentication servers. Please follow the steps named "Generate SSH Keys" and "For Systems on the SBGrid network at Longwood" below.

Off Quad systems (at MCB, HU, Tufts, Sanofi) please following the steps named "Generate SSH Keys" and "For Off-Quad SBGrid Systems" below.

Generating SSH Keys

We recommend using a password for ssh keys

1. You can generate ssh key-pair for local workstation from a Mac or Linux terminal: ssh-keygen -t ed25519 or ssh-keygen -t rsa
2. Press enter to accept the default location.
3. Enter a password for the key pair.
4. On both linux and Mac systems keys can be loaded with 'ssh-add .ssh/id_rsa'. You can see loaded keys with 'ssh-add -l'. The keys remain loaded until you log out.
5. Macintosh systems with keys in default locations should get loaded automatically when connecting to systems

For Off-Quad SBGrid Systems

1. Copy public key (~/.ssh/id_rsa.pub) to remote system: scp ~/.ssh/id_rsa.pub remotesys:~/ If this is the first connection to the remote system, type yes to accept the remote system key.
2. Login to remote system, configure remote system to trust public key:

• ssh remotesys
  • create ~/.ssh if it doesn't exist: mkdir ~/.ssh
  • cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
  • chmod 700 ~/.ssh
  • chmod 640 ~/.ssh/authorized_keys
  • Logout of remote system, and repeat login to check that everything works correctly. If so, ~/id_rsa.pub can be removed from the remote system.

For Systems on the SBGrid network in Longwood Medical area

The 'pub' key must be uploaded to our authentication servers. These examples assume you copied the pub key to your Linux home directory, you can also copy and paste the entire contents of the .pub file between systems.

• You will need to run these commands on xtal200.harvard.edu. If you are a Consortium member use shell.sbgrid.org.

 ipa user-mod $USER --sshpubkey="ssh-ed25519 AAAABBBBBBCCCCCZZZZZZZ qqq@mbp.local"

OR

 ipa user-mod $USER --sshpubkey="$(cat ~/.ssh/id_rsa.pub)"

For multiple keys (all must be added again with one command when adding new keys)

 ipa user-mod $USER --sshpubkey="$(cat ~/.ssh/id_rsa.pub)" --sshpubkey="$(cat ~/.ssh/id_ed25519.pub)"\
  --sshpubkey="$(cat ~/.ssh/othersystem_id_rsa.pub)"

If you are using csh/tcsh shell

 ipa user-mod $USER --sshpubkey="`cat ~/.ssh/id_rsa.pub`"

If you get a 'Kerberos Credential' error you will need to enter the following command, type your password and try again.

 kinit $USER

Note: The 'ipa' command is not available on most workstations, connect to xtal200.harvard.edu and perform the commands there.

Additional tips

Using Jump host to connect directly to your lab systems

ssh -J happyuser@xtal200.harvard.edu happyuser@ivory.in.hwlab

pass ssh key through to other hosts

• Create a .ssh/config file with your favorite editor

Host *
 ForwardAgent yes

Adjust permissions

chmod 600 ~/.ssh/config

Copy to network account

scp ~/.ssh/config happyuser@xtal200.harvard.edu:~/.ssh/config

Example ~/.ssh/.config file

Host *
  ServerAliveInterval 30
  ServerAliveCountMax 2
  StrictHostKeyChecking=accept-new
  ForwardAgent yes
Host othercluster.hms.harvard.edu
  User jj123
  Hostname othercluster.hms.harvard.edu
  PreferredAuthentications publickey
  IdentityFile ~/.ssh/othercluster-hms-rsa
  VisualHostKey=yes
# Jumphost Example
## First jump directly reachable
Host xtal200
  HostName xtal200.harvard.edu
  User xtaluser1
## Second jump. Only reachable via first jump
Host tklinux1 #ssh tklinux1 to connect
  HostName toms-linux-system.med.harvard.edu
  User xtaluser1
  ProxyJump xtal200
### third jump
Host mcluster1 #ssh mcluster1 to connect
  HostName mcluster1.gpucluster.crystal.harvard.edu
  User xtaluser1
  ProxyJump tklinux1